Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,680 total in npm · sorted newest first- Jun 20, 2022
Malicious code in wfs-admin-test (npm)
- Jun 20, 2022
Malicious code in training-platform-web (npm)
- Jun 20, 2022
Malicious code in asdaoptimaadmin (npm)
- Jun 20, 2022
Malware in wfs-lite-app
1 compromised version
- Jun 20, 2022
Malware in wfs-admin-test
1 compromised version
- Jun 20, 2022
Malware in training-platform-web
1 compromised version
- Jun 20, 2022
Malware in asdaoptimaadmin
1 compromised version
- Jun 20, 2022
Malicious code in watchlist-widget (npm)
- Jun 20, 2022
Malicious code in vue-smooth (npm)
- Jun 20, 2022
Malicious code in settings-ee (npm)
- Jun 20, 2022
Malicious code in elm-lang (npm)
- Jun 20, 2022
Malware in vue-smooth
1 compromised version
- Jun 20, 2022
Malware in watchlist-widget
1 compromised version
- Jun 20, 2022
Malware in settings-ee
1 compromised version
- Jun 20, 2022
Malware in elm-lang
1 compromised version
- Jun 20, 2022
Malicious code in searchcursor (npm)
- Jun 20, 2022
Malicious code in render_delegates (npm)
- Jun 20, 2022
Malicious code in marcom (npm)
- Jun 20, 2022
Malicious code in libidn2 (npm)
- Jun 20, 2022
Malware in searchcursor
1 compromised version
- Jun 20, 2022
Malware in marcom
1 compromised version
- Jun 20, 2022
Malware in render_delegates
1 compromised version
- Jun 20, 2022
Malware in libidn2
1 compromised version
- Jun 20, 2022
Malicious code in usabilla_live (npm)
- Jun 20, 2022
Malicious code in time_estimates (npm)
- Jun 20, 2022
Malicious code in soydata (npm)
- Jun 20, 2022
Malicious code in pixivsketch (npm)
- Jun 20, 2022
Malware in usabilla_live
1 compromised version
- Jun 20, 2022
Malware in pixivsketch
1 compromised version
- Jun 20, 2022
Malware in time_estimates
1 compromised version
- Jun 20, 2022
Malware in soydata
1 compromised version
- Jun 20, 2022
Malicious code in @naugtur/callhome (npm)
- Jun 20, 2022
Malicious code in f5-logger (npm)
- Jun 20, 2022
Malicious code in discord-rude-tool (npm)
- Jun 20, 2022
Malicious code in bing11testpak (npm)
- Jun 20, 2022
Malware in @naugtur/callhome
1 compromised version
- Jun 20, 2022
Malware in bing11testpak
1 compromised version
- Jun 20, 2022
Malware in discord-rude-tool
1 compromised version
- Jun 20, 2022
Malware in f5-logger
1 compromised version
- Jun 20, 2022
Malicious code in web3_socket (npm)
- Jun 20, 2022
Malicious code in pc-web_socket (npm)
- Jun 20, 2022
Malicious code in open-xchange-dynamic-theme (npm)
- Jun 20, 2022
Malicious code in open-xchange-appsuite (npm)
- Jun 20, 2022
Malware in open-xchange-appsuite
1 compromised version
- Jun 20, 2022
Malware in open-xchange-dynamic-theme
1 compromised version
- Jun 20, 2022
Malware in pc-web_socket
1 compromised version
- Jun 20, 2022
Malware in web3_socket
1 compromised version
- Jun 20, 2022
Malicious code in update-themes (npm)
- Jun 20, 2022
Malicious code in oxapi-documentations-build-script (npm)
- Jun 20, 2022
Malicious code in open-xchange-guidedtours (npm)
Page 6474 of 6,634